Verify Group Who Owns /etc/sysctl.d Directory
Ensures the /etc/sysctl.d directory is group-owned by root.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/sysctl.d directory holds drop-in files that set kernel parameters at boot (network hardening, ASLR, kptr_restrict, etc.). If its group owner is not root, members of that group could drop in a file that weakens these protections, for example re-enabling IP forwarding or disabling ASLR, undermining the system's kernel-level hardening.
What Pavois checks
Pavois reads the effective group owner of /etc/sysctl.d from the filesystem (stat), so it reports the real on-disk state even after a package recreates the directory. The runtime kernel values themselves are audited by the dedicated sysctl rules; this rule protects the source of those values from tampering.
only_if { file('/etc/sysctl.d').exist? }
describe file('/etc/sysctl.d') do
its('group') { should eq 'root' }
endHow to verify it is applied
Run stat -c '%G' /etc/sysctl.d. The expected output is root. Alternatively, ls -ld /etc/sysctl.d should show root in the group column.
Inspect & investigate
Ownership changes are not logged by default; inspect with ls -ld /etc/sysctl.d. The kernel parameters these files set are visible at runtime with sysctl -a. If auditd watches /etc/sysctl.d, ownership changes appear in /var/log/audit/audit.log.
Remediation
Pavois's harden plan sets the group of the file resource /etc/sysctl.d to root (equivalent to chgrp root /etc/sysctl.d). It is applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/sysctl.d |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Setting the group to root is the expected state and has no functional impact; kernel parameters keep applying at boot via systemd-sysctl. There is no lockout or service-disruption risk. The change touches only directory metadata, not the parameter files' contents.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.